Archive for August 6th, 2014

The biggest security headache that consumers face on a regular basis may well be… the password. You need one to do just about anything online nowadays. This makes them very valuable targets of theft – as the news that “1.2 billion” passwords were stolen highlights. Unfortunately, remembering passwords for all the sites that people use every day can be a challenge.

With that in mind, I was interested when I heard about a paper that discussed how users manage multiple passwords. Unfortunately, this paper from Microsoft and Canadian researchers doesn’t actually provide very good advice, and may in fact promote dangerous practices.

Let me summarize the paper for those who haven’t read it: they suggest that users are incapable of following both of the key tenets of password security: that passwords must be secure (i.e., not easily found with a dictionary-based search), and that they must not be shared. The researchers suggest that users decide which accounts need to be protected with secure passwords; the other accounts can be protected with ordinary passwords that don’t have to be unique or secure.

This idea only works if you accept as a fact that the user is incapable of remembering secure passwords. However, that’s why password managers exist. This idea that a user must rely on their unaided memory is simply wrong. The computer – whether it’s a PC, tablet, or smartphone – is an extraordinarily powerful tool. Why not use it?

Yes, these managers are not perfect. Just last month, another group of researchers found vulnerabilities in several online password managers. However, they’re still a significant improvement over trying to remember passwords by rote memory, and it’s a gigantic improvement over using poor passwords. The perfect should not be the enemy of the good.

I try to make the advice I give as clear as possible. Whether or not that was their intention, studies like this muddle the water and send the message that bad passwords are okay. It depends on the user discriminating between what needs to be secure and what isn’t. However, many users are likely to trade convenience for security and choose weak passwords instead. It’s human nature to do so. Sadly enough, the users most likely to choose weak passwords are also the ones who are likely to fall victim to various online threats.

Let’s say, however, that someone really doesn’t want to use a password manager. That doesn’t mean you need to use a bad, recycled password. Consider this procedure:

Choose a simple password you already use. Let’s take “Snoopy2″ as an example.

Create an algorithm in your mind that uses the full domain name of the website you’re protecting. So, for example, it can be: “two first letters, two last letters and the number of letters it has, first letter in uppercase”. “twitter.com” becomes “Twer7″. It can be any algorithm you want, so long as you remember it.

Choose a number has means something to you. Your birthday, the age at which you met your husband, whatever. Let’s say I use the number “32”.

Put it all together. My password for twitter would be “Twer7snoopy232″. My next password for “awesomecyclingforum.com” would be “Awum19Snoopy232″. If I ever need to change it, just add one to the last number… or 7. It’s up to you.

The bottom line is: one day we won’t have to use passwords to log into sites anymore. That day, however, is not today. We’re still stuck with passwords, and we need to provide the best advice to users on how to create good passwords. A mixed message – like the one promoted by these researchers – is unhelpful at best, and wrong-headed at worst.

Last week, the US Computer Emergency Readiness Team (US-CERT) reported about a newly discovered malware, dubbed “Backoff”, which targets point-of-sale (PoS) systems. Similar to other PoS malware such as Dexter and Scraper, Backoff is also used to steal financial information for malicious purposes.

Based on our analysis, when Backoff is executed, it copies itself into %Application Data%\OracleJava\javaw.exe and launches the copy in %Application Data% with parameter -m <path_to_original_backoff>. This will terminate the original Backoff process and delete the initial copy of itself. We have seen the same installation technique used in the Alina family of PoS RAM-scraping malware. More details of its routines can be found in the US-CERT article. This entry, however, focuses on the scope and breadth of its infection.

We analyzed Backoff and discovered that it has multiple versions, ranging from 1.4 to 1.55. The 1.55 build has multiple versions as well, differentiated by nicknames such as “backoff”, “goo” and “MAY.” The “goo” version connects to three malicious domains that we cannot disclose just yet as we are still looking into them.

Connection Patterns

Checking with our internal data, we also saw that these domains communicated a lot with the affected IP addresses, with the first two domains getting hits from the US. The first domain alone has had more than 46,000 hits since June 14, 2014. Interestingly, we found less hits from June 28 to July 25, with only 52 unique IPs.

Figure 1. Number of hits on the malicious domain #1

The second domain, meanwhile, scored more than 59,000 hits since April 26, 2014, with the same decline in the number of hits from May 8 to June 2, with only 60 unique IPs this time.

Figure 2. Number of hits on the malicious domain #2

We also noticed an interesting pattern when we changed the time frame to one-week increments.

Figure 3. Decreasing pattern in the number of hits. Pattern is similar for both domains.

We saw a clear decrease in the hits during “dead hours”, specifically at 2:00 AM. The hits went back up at 10:00 AM. This follows typical business operating hours wherein PoS devices are in active use — the number of hits rises as business operating hours begin and drops as businesses close for the day. Looking at the week-by-week statistics, the last week of July alone registered more than 10,000 hits.

US as Top Target

What does this all mean, then? For one, it cements the fact that Backoff is a very active and persistent threat that has already infected a lot of point-of-sale devices. Based on our Smart Protection Network data, the top country that accessed the malicious domains is the United States. Clearly, the US market is a favored target for those behind Backoff. As such, we recommend that businesses in the US have their PoS devices analyzed and secured.

Figure 4. Heat map of malicious communications found in affected US states

PoS malware could be one of the many constants in life that we would have to deal with, like social engineering scams and mobile malware. Cybercriminals obviously see this as profitable, which was exemplified in data breach incidents in the retail industry in 2013. An old vulnerability residing in PoS systems was exploited in order to carry the said attacks, which resulted in the loss of credit and debit card information of at least 40 million customers. Also, cybercriminals have begun to cut middlemen out, as some are actually mass-manufacturing pre-compromised PoS devices. We need to stop viewing PoS devices as mere tools or gadgets but as systems that also require tight security.